CVE-2024-0434

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to create and publish new place posts. This function is also vulnerable to CSRF.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: May 29, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-04355.4User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the mini CVE-2024-04365.9Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via CVE-2024-04374.3The Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease plugin for WordPress is vulnerable to Sensitiv CVE-2024-04385.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wrapper link parameter in the Age G CVE-2024-04398.8As a manager, you should not be able to modify a series of settings. In the UI this is indeed hidden as a convenience for the role since mos CVE-2024-04406.5Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspec CVE-2024-04426.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via element URL parameters in all CVE-2024-04435.5A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. CVE-2024-04448.8GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e CVE-2024-04455.4The The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's element attributes in a CVE-2024-04467.8A maliciously crafted STP, CATPART or MODEL file, when parsed in ASMKERN228A.dll and ASMdatax229A.dll through Autodesk AutoCAD, may force an CVE-2024-04475.0The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca